CVE-2026-53362: Linux Kernel Unspecified Vulnerability (KEV) Exploitation Indicators

let suspiciousParents = dynamic(["bash","sh","dash","zsh","python","python3","perl","nc","ncat"]);
DeviceProcessEvents
| where Timestamp > ago(1d)
| where AccountName == "root" or InitiatingProcessAccountName != "root"
| where InitiatingProcessAccountName != "root" and AccountName == "root"
| where InitiatingProcessFileName in~ (suspiciousParents)
| where ProcessCommandLine has_any ("id", "whoami", "/bin/sh", "setuid", "cap_setuid")
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine
| order by Timestamp desc

index=linux (sourcetype=linux_audit OR sourcetype=auditd)
| transaction host pid maxspan=5s
| search (type=SYSCALL syscall=* auid!=0 euid=0) OR (type=SYSCALL (arch=* comm="bash" OR comm="sh" OR comm="python*") euid=0 uid!=0)
| where auid!=euid AND euid=0 AND auid!=4294967295
| stats count values(comm) as commands values(exe) as executables by host, auid, ppid, _time
| where count > 0
| sort - _time

sequence by host.id with maxspan=10s
  [ process where event.type == "start" and user.id != "0" and process.name in ("bash","sh","dash","python","python3","perl") ]
  [ process where event.type == "start" and user.id == "0" and process.parent.name in ("bash","sh","dash","python","python3","perl") ]

SELECT QIDNAME(qid) AS event, sourceip, username, "Process Name" AS process, "Parent Process Name" AS parent, payload
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%Linux%'
  AND (payload ILIKE '%euid=0%' AND payload ILIKE '%auid=%' AND payload NOT ILIKE '%auid=0%')
  AND (payload ILIKE '%comm="bash"%' OR payload ILIKE '%comm="sh"%' OR payload ILIKE '%comm="python%')
  AND payload NOT ILIKE '%exe="/usr/bin/sudo"%'
ORDER BY starttime DESC
LAST 24 HOURS

_sourceCategory=*linux* (auditd OR audit)
| parse "auid=*" as auid nodrop
| parse "euid=*" as euid nodrop
| parse "comm=\"*\"" as comm nodrop
| where auid != "0" and auid != "4294967295" and euid = "0"
| where comm in ("bash","sh","dash","python","python3","perl")
| count by _sourceHost, auid, comm, euid
| where _count > 0
| sort by _count desc

rule cve_2026_53362_kernel_lpe {
  meta:
    author = "argus"
    description = "Non-root user achieving root via interactive shell - possible Linux kernel LPE (CVE-2026-53362)"
    severity = "HIGH"
  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.principal.process.parent_process.file.full_path = /.*(bash|sh|dash|python|perl)$/
    $e.principal.user.userid != "root"
    $e.target.user.userid = "root"
  match:
    $e.principal.hostname over 5m
  condition:
    $e
}

#event_simpleName=ProcessRollup2 event_platform=Lin
| ParentBaseFileName=/^(bash|sh|dash|python|python3|perl)$/
| UID!=0
| join({#event_simpleName=ProcessRollup2 event_platform=Lin UID=0}, field=[ParentProcessId], include=[FileName, CommandLine, UID], mode=left)
| groupBy([aid, ParentBaseFileName, FileName], function=count())
| sort(_count, order=desc)